bzuccaro
2bf8da739b
CI / cargo fmt (push) Canceled after 0s
CI / cargo clippy (macos-latest) (push) Canceled after 0s
CI / cargo clippy (ubuntu-latest) (push) Canceled after 0s
CI / cargo clippy (windows-latest) (push) Canceled after 0s
CI / cargo test (macos-latest) (push) Canceled after 0s
CI / cargo test (ubuntu-latest) (push) Canceled after 0s
CI / cargo test (windows-latest) (push) Canceled after 0s
CI / cargo build (macos-latest) (push) Canceled after 0s
CI / cargo build (ubuntu-latest) (push) Canceled after 0s
CI / cargo build (windows-latest) (push) Canceled after 0s
CI / cargo build --release (macos-latest) (push) Canceled after 0s
CI / cargo build --release (ubuntu-latest) (push) Canceled after 0s
CI / cargo build --release (windows-latest) (push) Canceled after 0s
CI / CLI smoke (macos-latest) (push) Canceled after 0s
CI / CLI smoke (ubuntu-latest) (push) Canceled after 0s
CI / CLI smoke (windows-latest) (push) Canceled after 0s
CI / Minimal E2E (macos-latest) (push) Canceled after 0s
CI / Minimal E2E (ubuntu-latest) (push) Canceled after 0s
CI / Minimal E2E (windows-latest) (push) Canceled after 0s
Connection keys are now a ~49-char seed (rtun3.) instead of a bundled ~1740-char certificate blob. Both endpoints deterministically derive an identical Ed25519 CA from the seed and mint ephemeral server/client leaves at startup (keyderive.rs); the app-layer auth token is derived from the seed. Target is passed separately on connect (resocks-style). - connkey.rs: rtun3 seed parse/format - keyderive.rs: CA/server/client/token derivation - keygen takes no args; connect requires --target - remove miniz_oxide; TLS layer unchanged - add determinism + key-based e2e + wrong-seed-rejected tests - update wiki, README, design spec, CI smoke
89 lines
2.4 KiB
Markdown
89 lines
2.4 KiB
Markdown
# Data models
|
|
|
|
## ConnectionKey
|
|
|
|
```rust
|
|
pub struct ConnectionKey {
|
|
seed: [u8; 32], // random seed from which all TLS material is derived
|
|
}
|
|
```
|
|
|
|
Encoded as: `rtun3.` + base64url(32-byte seed) — no padding (~49 chars). No
|
|
certificates are stored in the key; both endpoints derive the same CA and
|
|
ephemeral leaves from the seed (`src/keyderive.rs`).
|
|
|
|
## Config
|
|
|
|
```rust
|
|
pub struct Config {
|
|
pub listen_address: String,
|
|
pub listen_port: u16,
|
|
pub socks_address: String,
|
|
pub socks_port: u16,
|
|
pub ca_cert_path: String,
|
|
pub server_cert_path: String,
|
|
pub server_key_path: String,
|
|
pub client_cert_path: String,
|
|
pub client_key_path: String,
|
|
pub auth_token_path: String,
|
|
}
|
|
```
|
|
|
|
## Frame
|
|
|
|
```rust
|
|
pub struct Frame {
|
|
pub frame_type: u8, // 0x01 CONNECT, 0x02 CONNECT_REPLY, 0x03 DATA, 0x04 CLOSE, 0x05 ERROR
|
|
pub stream_id: u64, // odd for client-initiated
|
|
pub flags: u8, // reserved (0x00)
|
|
pub payload: Bytes,
|
|
}
|
|
```
|
|
|
|
Wire format: 1 byte type + 8 bytes stream_id (big-endian) + 4 bytes len (big-endian) + 1 byte flags + len bytes payload.
|
|
|
|
Max payload: 4 MiB.
|
|
|
|
## Socks5Target
|
|
|
|
```rust
|
|
pub enum Socks5Target {
|
|
Ipv4(std::net::Ipv4Addr, u16),
|
|
Domain { domain: String, port: u16 },
|
|
}
|
|
```
|
|
|
|
## GeneratedMaterial
|
|
|
|
```rust
|
|
pub struct GeneratedMaterial {
|
|
pub ca_cert_pem: String,
|
|
pub ca_key_pem: String,
|
|
pub server_cert_pem: String,
|
|
pub server_key_pem: String,
|
|
pub client_cert_pem: String,
|
|
pub client_key_pem: String,
|
|
pub auth_token: String,
|
|
}
|
|
```
|
|
|
|
## Error enums
|
|
|
|
- `TlsError` — missing/invalid certificates, identity mismatch, expiration, verification failure
|
|
- `AuthError` — missing or invalid token
|
|
- `TunnelError` — TLS error, auth error, bind error, connection refused, port in use, protocol error
|
|
- `HostError` — DNS resolution failure, invalid hostname, no addresses
|
|
- `Socks5Error` — invalid version, unsupported auth/command/addr type, parse errors
|
|
- `FrameError` — frame too short, payload overflow, I/O error, protocol error
|
|
|
|
## Key source files
|
|
|
|
| File | Purpose |
|
|
| ---- | ------- |
|
|
| `src/connkey.rs` | `ConnectionKey` |
|
|
| `src/config.rs` | `Config` |
|
|
| `src/framing.rs` | `Frame`, `FrameReader`, `FrameWriter` |
|
|
| `src/socks5.rs` | `Socks5Target`, `Socks5State`, `Socks5Error` |
|
|
| `src/generate.rs` | `GeneratedMaterial` |
|
|
| `src/errors.rs` | `TlsError`, `AuthError`, `TunnelError`, `HostError` |
|